CVE-2025-54403
📋 TL;DR
This CVE describes OS command injection vulnerabilities in Planet WGR-500 routers that allow remote attackers to execute arbitrary commands via specially crafted network requests targeting the 'new_password' parameter. Attackers can gain full control of affected devices. Organizations using Planet WGR-500 routers with vulnerable firmware are affected.
💻 Affected Systems
- Planet WGR-500
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of the router allowing attackers to pivot to internal networks, intercept/modify traffic, install persistent backdoors, or use the device for botnet activities.
Likely Case
Router takeover leading to network traffic interception, credential theft, and potential lateral movement to connected devices.
If Mitigated
Limited impact if device is behind strict network segmentation with no internet exposure and strong access controls.
🎯 Exploit Status
Based on the description, exploitation appears straightforward via network requests to the vulnerable parameter. No authentication bypass needed.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: Not available
Restart Required: Yes
Instructions:
1. Check Planet vendor website for firmware updates
2. Download latest firmware if available
3. Upload via router admin interface
4. Reboot router after update
5. Verify version is no longer v1.3411b190912
🔧 Temporary Workarounds
Network Isolation
allIsolate affected routers from internet and restrict network access
Access Control Lists
linuxImplement strict firewall rules to limit access to router management interface
iptables -A INPUT -p tcp --dport [router-port] -s [trusted-ip] -j ACCEPT
iptables -A INPUT -p tcp --dport [router-port] -j DROP
🧯 If You Can't Patch
- Replace affected routers with different models or vendors
- Implement network segmentation to isolate router traffic and limit blast radius
🔍 How to Verify
Check if Vulnerable:
Check router firmware version via admin interface. If version is v1.3411b190912, device is vulnerable.Check Version:
Check via router web interface or SSH: show version or equivalent commandVerify Fix Applied:
Verify firmware version has changed from v1.3411b190912 and test password change functionality with malicious payloads.📡 Detection & Monitoring
Log Indicators:
- Unusual password change attempts
- Suspicious commands in system logs
- Multiple failed authentication attempts followed by password changes
Network Indicators:
- Unusual outbound connections from router
- Traffic to known malicious IPs
- Unexpected SSH/Telnet connections from router
SIEM Query:
source="router.log" AND ("new_password" OR "swctrl") AND (cmd.exe OR bash OR sh OR | OR ; OR $)